• 0 Posts
  • 4 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle



  • A pass key is the private key in a private/public key pair. The private key is stored in the TPM on your device. The website contains the public key. When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

    What this means in practice is that if a website has a data breach they won’t have your hashed password, only your public key which… is public. It doesn’t and can’t do anything on its own. It needs the private key, which again only you have and the website doesn’t store, to do anything at all.

    If you want to read more about it look into cryptographic key pairs. Pretty neat how they work.